Security Disclosures

Threats caught in the agent economy: x402 endpoints with on-chain proof, and MCP packages that changed after adoption · by PulseFeed · Drift Watch · Changes · Observatory

200
high severity
135
medium
0
receiver hijacks
0
bait-and-switch
335
total active

Active incidents

💨
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
6h ago
🕳
alvin-bot mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 5.101.2 → 5.103.0. The package is installed about 14,362 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ alvin-bot repo_removed
6h ago
🎭
@bangdao-ai/acw-tools mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.13.66 → 1.13.68. The package is installed about 13,564 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @bangdao-ai/acw-tools maintainer_changed
1d ago
🎭
@gjsify/devtools-protocol mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 793 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @gjsify/devtools-protocol maintainer_changed
1d ago
🎭
@gjsify/devtools mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @gjsify/devtools maintainer_changed
1d ago
🎭
@gjsify/devtools-cdp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 515 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @gjsify/devtools-cdp maintainer_changed
1d ago
🎭
@gjsify/devtools-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 499 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @gjsify/devtools-mcp maintainer_changed
1d ago
🎭
@gjsify/devtools-browser mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 490 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @gjsify/devtools-browser maintainer_changed
1d ago
🎭
@gjsify/devtools-nativescript mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 501 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
1d ago
🎭
@hubspot/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @hubspot/mcp-server maintainer_changed
2d ago
🎭
@taptap/maker mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 6,034 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @taptap/maker maintainer_changed
2d ago
🎭
@powerhousedao/reactor-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @powerhousedao/reactor-mcp maintainer_changed
2d ago
🎭
@armature-tech/mcp-analytics mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,350 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
2d ago
🎭
@seed-design/docs-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,293 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @seed-design/docs-mcp maintainer_changed
2d ago
☠️
jazz-ai mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.15.6. Versions: 0.15.6 → 0.15.8. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ jazz-ai install_script_added
2d ago
🎭
vision-relay mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.11.1 → 0.12.15. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ vision-relay maintainer_changed
2d ago
💨
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
3d ago
☠️
suppa-mcp-2 mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 1.14.0. Versions: 1.14.0 → 1.16.1. The package is installed about 1,011 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ suppa-mcp-2 install_script_added
3d ago
💨
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
3d ago
💨
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
4d ago
🎭
mcp-remote mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.2.1 → 0.2.5. The package is installed about 1,352,008 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ mcp-remote maintainer_changed
4d ago
🎭
@cognium-ai/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 4.6.1 → 4.7.0. The package is installed about 1,597 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @cognium-ai/mcp-server maintainer_changed
4d ago
🎭
@mirofish-ai/pi-gui-use mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @mirofish-ai/pi-gui-use maintainer_changed
4d ago
💨
com.uicockpit/mcp mcp unpublished
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
5d ago
🎭
@ibm/ibmi-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 776 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @ibm/ibmi-mcp-server maintainer_changed
5d ago
💨
Package removed from npm — installs will break, and the name is now free for anyone to claim. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
6d ago
🎭
mcp-remote mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.1.38 → 0.1.43. The package is installed about 511,861 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ mcp-remote maintainer_changed
8d ago
🎭
agentmail-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 8,315 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ agentmail-mcp maintainer_changed
8d ago
🎭
@doist/todoist-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @doist/todoist-mcp maintainer_changed
8d ago
☠️
genexus-mcp mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 2.43.0. Versions: 2.43.0 → 2.44.1. The package is installed about 2,462 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ genexus-mcp install_script_added
8d ago
🎭
@slashfi/agents-sdk mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 13,121 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @slashfi/agents-sdk maintainer_changed
9d ago
🎭
@ecosyste-ms/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 992 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @ecosyste-ms/mcp maintainer_changed
9d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
10d ago
🎭
@ganintegrity/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @ganintegrity/mcp maintainer_changed
10d ago
☠️
@essentialai/cogent-bridge mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 3.18.0. Versions: 3.18.0 → 3.20.2. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @essentialai/cogent-bridge install_script_added
10d ago
🎭
@workos/mcp-docs-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @workos/mcp-docs-server maintainer_changed
11d ago
☠️
termfleet mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.2.1. Versions: 0.2.1 → 0.2.2. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ termfleet install_script_added
11d ago
🎭
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
12d ago
🎭
@cloudcruise/cli mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 684 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @cloudcruise/cli maintainer_changed
12d ago
🎭
@aikidosec/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 21,822 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @aikidosec/mcp maintainer_changed
15d ago
🎭
@postman/postman-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 4,937 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @postman/postman-mcp-server maintainer_changed
16d ago
🎭
sunpeak mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ sunpeak maintainer_changed
17d ago
🎭
@edgescaleai/cube-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @edgescaleai/cube-mcp maintainer_changed
17d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 4,705 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
18d ago
🎭
@fabric-harness/sdk mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @fabric-harness/sdk maintainer_changed
19d ago
🎭
@mondaydotcomorg/atp-mcp-adapter mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.25.0 → 0.26.0. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
19d ago
🎭
@meshy-ai/meshy-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @meshy-ai/meshy-mcp-server maintainer_changed
19d ago
🎭
@fabric-harness/connectors mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @fabric-harness/connectors maintainer_changed
19d ago
🎭
@meeting-baas/sdk mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 6.2.0 → 6.2.3. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @meeting-baas/sdk maintainer_changed
19d ago
🎭
@octopusdeploy/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,585 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @octopusdeploy/mcp-server maintainer_changed
20d ago
☠️
@fidacy/mcp mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.2.8. Versions: 0.2.8 → 0.15.3. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @fidacy/mcp install_script_added
20d ago
☠️
nyxora mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 26.7.10. Versions: 26.7.10 → 26.8.4. The package is installed about 448 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ nyxora install_script_added
20d ago
🕳
@pushary/agent-hooks mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.54.1 → 0.75.0. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
27d ago
🎣
api.invoket.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x4465825B… price_bait_switch price_rising
7h ago
🔀
gateway.stride20k.com receiver changed
changed its payTo receiver 0xabe5…0441 → 0x552c…a3f6 after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
on-chain proof ↗ 0x552cc4a1… payto_changed_unconfirmed
7h ago
🎣
api.hyperextend.xyz advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x548fC289… price_bait_switch
1d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
1d ago
🎣
kino402.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x2A266c87… price_bait_switch unverifiable
1d ago
🎣
cryptoops.friczero.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xA18E3460… price_bait_switch unverifiable
1d ago
🔀
api.certaindata.ai receiver changed
changed its payTo receiver 0x2b87…bb39 → 0x9a4f…6bb0 after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
on-chain proof ↗ 0x9a4fb846… payto_changed_unconfirmed template_url
1d ago
🎣
headlessoracle.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x26D4Ffe9… price_bait_switch
2d ago
💸
x721.dev price above norm
its price (40.2/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x70DA5f2A… price_absurd
2d ago
💸
api.x721.dev price above norm
its price (40.2/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x70DA5f2A… price_absurd
2d ago
💸
x402.fablerlabs.com price above norm
its price (29/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x65E3E649… price_absurd
2d ago
🎣
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xc91cE629… price_bait_switch price_rising
2d ago
💸
productclank.com price above norm
its price (50/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x876Be690… price_absurd unverifiable
2d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet unverifiable
2d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet unverifiable
2d ago
🧪
sandbox.node4all.com testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
3d ago
🎣
api.justaname.id advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xc529edd6… price_bait_switch price_rising
3d ago
🎣
dripstack.xyz advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xBF22b6Dd… price_high price_bait_switch price_rising
3d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
3d ago
🎣
kronos-x402.vercel.app advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x36038e1d… price_bait_switch price_rising
3d ago
🧪
staging.402utils.com testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
3d ago
🧪
x402-ai-starter.vercel.app testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
on-chain proof ↗ 0x78397B97… network_testnet unverifiable
3d ago
🔀
agents.x402stock.xyz receiver changed
changed its payTo receiver 0x70b1…1e07 → 0xfdb4…ed03 after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
on-chain proof ↗ 0xfdb4b511… payto_changed_unconfirmed template_url
3d ago
🔀
changed its payTo receiver 0x52e9…36be → 0x6e9c…62b2 after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
on-chain proof ↗ 0x6e9c2ebc… payto_changed_unconfirmed
3d ago
🎣
api.gocreativeai.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xbAf55b24… price_bait_switch
4d ago
🎣
agentdatum.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xCd265870… price_bait_switch
4d ago
💸
ads.gitlawb.com price above norm
its price (25/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0xA05C8d9E… price_absurd unverifiable
4d ago
🧪
api.bakebakebake.no testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link template_url network_testnet
4d ago
🧪
agents.aiscale.pro testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
4d ago
🎣
minia2a.uk advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xAb62452b… price_high price_bait_switch unverifiable
4d ago
🧪
preview.agenticinsights.com testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
5d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
5d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
5d ago
💸
apexrunner.ai price above norm
its price (35/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x8D0663BB… price_absurd unverifiable
5d ago
🎣
x402.openrng.io advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xBd5eB555… payto_changed_unconfirmed price_bait_switch price_rising
5d ago
🎣
api.resetparatodos.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x54beA1e6… price_bait_switch unverifiable
5d ago
🎭
aegis-ai.xyz challenge mismatch
its 402 body and its PAYMENT-REQUIRED header state different payment terms — an x402 v2 client pays what the HEADER says, which is not what a body-only check shows.
on-chain proof ↗ 0x52d49011… challenge_mismatch unverifiable
5d ago
🔀
x402.openrng.io receiver changed
changed its payTo receiver 0x6323…10dc → 0xbd5e…ce28 after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
on-chain proof ↗ 0xbd5eb555… payto_changed_unconfirmed price_bait_switch price_rising
5d ago
🎣
x402.clashofcoins.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x93862e5b… price_bait_switch
6d ago
🎣
api.seerium.xyz advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x81832eED… price_bait_switch
6d ago
🧪
api-dev.intra-tls2.dctx.link testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
on-chain proof ↗ 0xdEe1Ed75… network_testnet
6d ago
💸
api.tantra-authority.com price above norm
its price (29.97/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0xa8c3cd00… price_absurd
6d ago
🎣
agentpay.tools advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xE8B25A72… price_bait_switch
6d ago
🎣
agenttax.io advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x6f4B383B… price_bait_switch
6d ago
🎣
agents.allium.so advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xd2938742… payto_rotating price_bait_switch payto_unverified_onchain
6d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
6d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
6d ago
🎣
orionkr.xyz advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xd30fa341… price_bait_switch
6d ago
🎣
api.strale.io advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x66D7C2F9… price_bait_switch
6d ago
🎣
x402-cybercentry.up.railway.app advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xfee13309… price_high price_bait_switch unverifiable
6d ago
🎣
api.sygnliq.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x3A86924d… price_bait_switch unverifiable
6d ago
🎣
kairostamp.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xdB6F694a… price_bait_switch unverifiable
6d ago
💸
its price (25/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0xaeDa0FE8… price_absurd unverifiable
6d ago
🔀
twitter.surf.cascade.fyi receiver changed
changed its payTo receiver Fo2EYEYbnJTNnBnbAgnjnG1c2fixpFn1vSUUHSeoHhRP → 9MkM5Ra48KFcSv9HDQ8sb3C3r5HjouEwGQ6sp1cx1vde after a stable baseline. Routine rotation and compromise look identical from outside — re-verify before paying.
receiver not on Base — no on-chain link payto_changed
6d ago
🧪
clonecho.builda.company testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
on-chain proof ↗ 0xe9AE2cab… network_testnet
7d ago
🎣
tenjin.blog advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x578c640E… template_url price_bait_switch
7d ago
🧪
api-dev.cueframe.ai testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet
7d ago
🧪
staging.miven.dev testnet as production
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet unverifiable
7d ago
💸
taxpulse-phi.vercel.app price above norm
its price (12/call) is far above the ecosystem norm. That may be entirely legitimate for what it returns — we measure the number, not its fairness.
on-chain proof ↗ 0x50ab2018… price_absurd unverifiable
7d ago
🎣
quotient-api-gateway.onrender.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0xC3d01FD2… price_bait_switch price_rising
7d ago
🧪
requires payment on a TEST network — the price shown in dollars is not real money.
receiver not on Base — no on-chain link network_testnet unverifiable
7d ago
🎣
api2.romny.dpdns.org advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x90C3E979… price_bait_switch unverifiable
8d ago
🎣
defidata.hergertsynthora.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x10800a5a… price_bait_switch price_rising
9d ago
🎣
perps.hergertsynthora.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x10800a5a… price_bait_switch unverifiable
9d ago
🎣
openinterest.hergertsynthora.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x10800a5a… price_bait_switch unverifiable
9d ago
🎣
derivbundle.hergertsynthora.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x10800a5a… price_bait_switch unverifiable
9d ago
🎣
market-dominance.hergertsynthora.com advertised price mismatch
the price listed in the catalog differs from the amount its live 402 challenge requests.
on-chain proof ↗ 0x10800a5a… price_bait_switch unverifiable
9d ago
Why this matters — ~38% of x402 endpoints are dead or scams, and a safe endpoint can be hijacked or repriced overnight. Every incident above is derived from PulseFeed's continuous independent audit and, where the receiver is on Base, linked to on-chain proof you can verify yourself.

Verify before your agent pays: GET /trust?endpoint=<url> · Machine-readable: /incidents.json · Full dataset: PulseFeed Data API

Honesty note: categories are stated as facts from our data (e.g. "payTo has no on-chain USDC history", "advertised price ≠ amount actually charged"). We do not assert intent where it can't be proven; an "unverified receiver" or "possible hijack" is a risk signal, not a conviction. By-design receiver rotation is excluded. Window: 30 days · 335 active incidents · generated 2026-08-30T08:12:02.229Z.
Observatory · Changes · Methodology · Data API